{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-23133","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-01-11T14:28:41.511Z","datePublished":"2025-04-16T14:13:14.485Z","dateUpdated":"2026-08-05T11:56:59.697Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:56:59.697Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: update channel list in reg notifier instead reg worker\n\nCurrently when ath11k gets a new channel list, it will be processed\naccording to the following steps:\n1. update new channel list to cfg80211 and queue reg_work.\n2. cfg80211 handles new channel list during reg_work.\n3. update cfg80211's handled channel list to firmware by\nath11k_reg_update_chan_list().\n\nBut ath11k will immediately execute step 3 after reg_work is just\nqueued. Since step 2 is asynchronous, cfg80211 may not have completed\nhandling the new channel list, which may leading to an out-of-bounds\nwrite error:\nBUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list\nCall Trace:\n    ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]\n    kfree+0x109/0x3a0\n    ath11k_regd_update+0x1cf/0x350 [ath11k]\n    ath11k_regd_update_work+0x14/0x20 [ath11k]\n    process_one_work+0xe35/0x14c0\n\nShould ensure step 2 is completely done before executing step 3. Thus\nWen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,\ncfg80211 will notify ath11k after step 2 is done.\n\nSo enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will\nnotify ath11k after step 2 is done. At this time, there will be no\nKASAN bug during the execution of the step 3.\n\n[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The trigger is an 802.11d Country IE in beacons/probe responses harvested by the firmware's periodic 11d offload scan, which drives `WMI_11D_NEW_COUNTRY_EVENTID` → `ath11k_reg_set_cc()` → `WMI_REG_CHAN_LIST_CC_EVENTID` → `ath11k_regd_update_work`. This requires only RF proximity to the victim's Wi-Fi radio, matching the adjacent-network scope for Wi-Fi frame injection.\nAC:L - The attacker initiates both racing workers with a single beaconed country change — `ath11k_regd_update_work` on the ath11k workqueue and cfg80211's `reg_work` on the system workqueue — and the window is widened by the sleeping `kzalloc(GFP_KERNEL)` and per-channel `ath11k_dbg()` calls between the counting and filling loops. Since 11d scans repeat on a fixed interval and the attacker can toggle the advertised country indefinitely, the race can be retried until won.\nPR:N - No credentials, association, or authentication are needed — the firmware's 11d scan ingests Country IEs from unassociated broadcast beacons of any AP in range. No local account on the victim is involved at any point in the path.\nUI:N - A station interface that is simply up and scanning (the normal state for a laptop, phone, or embedded client) runs the 11d scan automatically; no user action such as connecting to the rogue AP is required. The regdomain update and the racing workers are entirely kernel-internal once the beacon is received.\nS:U - The out-of-bounds write corrupts kernel slab memory adjacent to the `scan_chan_list_params` allocation, staying within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - A heap out-of-bounds write of up to ~1–2 KB of `struct channel_param` records overwrites adjacent slab objects, which can be groomed (e.g. onto neighboring length or pointer fields) to yield an information-disclosure primitive. Per kernel scoring guidance, memory corruption that can be leveraged for disclosure rates High.\nI:H - This is a genuine slab out-of-bounds write with attacker-influenced length (via race timing over which bands cfg80211 has re-enabled) and partially attacker-influenced contents (`mhz`, `cfreq1`, `maxpower`, `maxregpower`, `antennamax` derived from the attacker-chosen regdomain). Out-of-bounds writes into adjacent heap objects are a standard route to control-flow hijack and rate High.\nA:H - The bug was found as a KASAN slab-out-of-bounds report followed by heap corruption at `kfree()`, which reliably produces oopses/panics on hardened or SLUB-debug kernels and unpredictable kernel state otherwise. Any such crash of the kernel is a full availability loss."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/reg.c"],"versions":[{"version":"f45cb6b29cd36514e13f7519770873d8c0457008","lessThan":"26618c039b78a76c373d4e02c5fbd52e3a73aead","status":"affected","versionType":"git"},{"version":"f45cb6b29cd36514e13f7519770873d8c0457008","lessThan":"f952fb83c9c6f908d27500764c4aee1df04b9d3f","status":"affected","versionType":"git"},{"version":"f45cb6b29cd36514e13f7519770873d8c0457008","lessThan":"933ab187e679e6fbdeea1835ae39efcc59c022d2","status":"affected","versionType":"git"},{"version":"f96fd36936310cefe0ea1370a9ae30e6746e6f62","status":"affected","versionType":"git"},{"version":"c97b120950b49d76bdce013bd4d9577d769465f4","status":"affected","versionType":"git"},{"version":"5.15.79","lessThan":"5.16","status":"affected","versionType":"semver"},{"version":"6.0.9","lessThan":"6.1","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath11k/reg.c"],"versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","status":"unaffected","versionType":"semver"},{"version":"6.12.46","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.14.2","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.12.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.14.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead"},{"url":"https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f"},{"url":"https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2"}],"title":"wifi: ath11k: update channel list in reg notifier instead reg worker","x_generator":{"engine":"bippy-1.2.0"}}}}